secure-code-agent 0.12.3__tar.gz → 0.12.4__tar.gz

{secure_code_agent-0.12.3/src/secure_code_agent.egg-info → secure_code_agent-0.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.3
+Version: 0.12.4
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -513,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.3
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -523,7 +523,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4}/README.md

@@ -465,7 +465,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.3
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -475,7 +475,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.3
+Version: 0.12.4
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -513,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.3
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -523,7 +523,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.3"
+__version__ = "0.12.4"

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4}/src/secure_code_audit/cli.py

@@ -82,6 +82,15 @@ def _parser() -> argparse.ArgumentParser:
     p.add_argument("--output", help="Markdown report output path.")
     p.add_argument("--json-output", help="Canonical JSON output path.")
     p.add_argument("--sarif-output", help="SARIF 2.1.0 output path.")
+    p.add_argument(
+        "--code-scanning-sarif-output",
+        help=(
+            "SARIF for upload to GitHub code scanning: the --sarif-output results "
+            "without the suppressed ones (test tree, documentation, .scignore.yaml). "
+            "Code scanning opens an alert for every uploaded result and ignores "
+            "SARIF suppressions, so upload this file, not the record."
+        ),
+    )
     p.add_argument("--comment-output", help="PR-comment markdown output path.")
     p.add_argument("--prompt-output", help="Remediation prompt output path.")
     p.add_argument(
@@ -795,6 +804,7 @@ def _own_artifacts(paths: _OutputPaths, cfg: config_mod.Config, root: Path) -> f
         paths.markdown,
         paths.json_out,
         paths.sarif,
+        paths.code_scanning_sarif,
         paths.comment,
         paths.prompt,
         paths.security_pillar,
@@ -933,6 +943,14 @@ def _write_outputs(
         renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict, axes, root)
     if paths.sarif is not None:
         sarif.write(findings, paths.sarif, coverage, lambda f: renderers.axis_of(f, axes))
+    if paths.code_scanning_sarif is not None:
+        sarif.write(
+            findings,
+            paths.code_scanning_sarif,
+            coverage,
+            lambda f: renderers.axis_of(f, axes),
+            alerts_only=True,
+        )
     if paths.comment is not None:
         renderers.write_pr_comment(findings, score, gate, paths.comment, coverage, verdict)
     if paths.prompt is not None:
@@ -970,6 +988,7 @@ class _OutputPaths:
     comment: Path | None
     prompt: Path | None
     security_pillar: Path | None
+    code_scanning_sarif: Path | None = None
 
 
 def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Path) -> _OutputPaths:
@@ -1014,6 +1033,7 @@ def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Pat
         comment=_p(args.comment_output, "comment_path"),
         prompt=_p(args.prompt_output, "prompt_path"),
         security_pillar=_p(args.security_pillar, "security_pillar_path"),
+        code_scanning_sarif=_p(args.code_scanning_sarif_output, "code_scanning_sarif_path"),
     )
 
 
@@ -1027,6 +1047,7 @@ _WRITE_KEYS = (
     "markdown_path",
     "json_path",
     "sarif_path",
+    "code_scanning_sarif_path",
     "comment_path",
     "prompt_path",
     "security_pillar_path",
@@ -1169,6 +1190,7 @@ def _print_summary(
             paths.markdown,
             paths.json_out,
             paths.sarif,
+            paths.code_scanning_sarif,
             paths.comment,
             paths.prompt,
             paths.security_pillar,

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4}/src/secure_code_audit/config.py

@@ -136,6 +136,10 @@ DEFAULT_OUTPUTS: dict[str, str] = {
     "markdown_path": "secure-code-report.md",
     "json_path": "secure-code-report.json",
     "sarif_path": "secure-code.sarif",
+    # For upload to code scanning: the SARIF above without results that carry
+    # `suppressions`, which GitHub turns into alerts regardless (D22). Off
+    # unless declared, like sarif_path.
+    "code_scanning_sarif_path": "secure-code.code-scanning.sarif",
     "comment_path": "secure-code-pr-comment.md",
     "prompt_path": "secure-code-remediation-prompt.md",
     "baseline_path": "secure-code-baseline.json",

{secure_code_agent-0.12.3 → secure_code_agent-0.12.4}/src/secure_code_audit/sarif.py

@@ -18,6 +18,7 @@ from secure_code_audit.scanner_status import (
     ScannerExecution,
     ScannerOutcome,
 )
+from secure_code_audit.scoring import GATED_FROM_ANY_AXIS
 from secure_code_audit.standards import cwe_url
 
 _SARIF_LEVEL = {
@@ -33,8 +34,25 @@ def emit(
     findings: Iterable[Finding],
     coverage: CoverageReport | None = None,
     axis_of=lambda _f: "primary",
+    *,
+    alerts_only: bool = False,
 ) -> dict:
-    """Build a SARIF 2.1.0 document from canonical findings."""
+    """Build a SARIF 2.1.0 document from canonical findings.
+
+    `alerts_only` builds the document for upload to a code-scanning platform:
+    results carrying `suppressions` are left out, rather than kept with the
+    field. GitHub code scanning opens an alert for every uploaded result and
+    does not act on `suppressions`, so the standard form turned each
+    test-tree `assert` into a pull-request review thread once D20 made paths
+    placeable (D22). The default keeps every result, as the record.
+
+    **Except what the build fails on.** A side-axis finding in a category the
+    gate escalates from any axis — a secret in a test fixture — is marked
+    suppressed in the record and still uploaded, without the marker, so the
+    Security tab shows the finding that failed the build. An operator's
+    reviewed suppression is left out whatever its category; it returns as a
+    live critical finding when it expires.
+    """
     findings = list(findings)
 
     # Build the rules array per-canonical-rule (rule_id is local; dedupe).
@@ -42,10 +60,15 @@ def emit(
     results: list[dict] = []
 
     for f in findings:
+        result = _result(f, axis_of(f))
+        if alerts_only and result.get("suppressions"):
+            if f.suppressed or f.category not in GATED_FROM_ANY_AXIS:
+                continue
+            del result["suppressions"]
         rid = f.rule_id
         if rid not in rule_meta:
             rule_meta[rid] = _rule(f)
-        results.append(_result(f, axis_of(f)))
+        results.append(result)
 
     run = {
         "tool": {
@@ -144,8 +167,13 @@ def _suppressions(f: Finding, axis: str) -> list[dict] | None:
     the shipped source.
 
     Suppressed, not omitted. The finding stays in the file with its
-    location and justification, so nothing is hidden from a reader — it
-    simply does not become someone's ticket.
+    location and justification, so nothing is hidden from a reader.
+
+    **GitHub code scanning does not honour it (D22).** It opens an alert for
+    every uploaded result regardless, which this function's premise assumed
+    it would not. So this is right for the record, and not enough for the
+    upload: `emit(..., alerts_only=True)` leaves these results out of the
+    file that goes to code scanning.
     """
     if f.suppressed:
         return [
@@ -206,8 +234,11 @@ def write(
     output: Path,
     coverage: CoverageReport | None = None,
     axis_of=lambda _f: "primary",
+    *,
+    alerts_only: bool = False,
 ) -> None:
-    output.write_text(json.dumps(emit(findings, coverage, axis_of), indent=2), encoding="utf-8")
+    document = emit(findings, coverage, axis_of, alerts_only=alerts_only)
+    output.write_text(json.dumps(document, indent=2), encoding="utf-8")
 
 
 # ----- ingest -------------------------------------------------------------